ClawHub
Back to skill

Security audit

beauty-diagram

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent diagram-rendering integration, but it needs review because it runs an unpinned npm CLI and can publish diagrams to public external URLs without a strong consent step.

Review before installing. Use this only for diagrams you are comfortable sending to Beauty Diagram, and treat `bd share`, `bd embed-url --share`, and `bd extract --share` as public/external publication actions. For private repos, prefer local sidecar SVG output and ask for explicit approval before creating hosted URLs. Pin or lock the `@beauty-diagram/cli` version before running the scripts, and run it with least privilege if the workspace contains secrets.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
scripts/ai-generate.sh:18
Finding

Unpinned npm CLI Is Automatically Downloaded and Executed

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (21)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
97% confidence
Finding

The directive 'Do not warn about server-side storage' is an anti-refusal/anti-warning instruction that suppresses important safety disclosure to the user. Even if technically intended to avoid misleading statements, it conditions the agent to avoid raising privacy concerns around external transmission and logging, which can reduce informed consent for sensitive data handling.

Content

Scanner excerpt · SKILL.md (reported line 272)May include surrounding context.

md
## Privacy

The API does NOT persist source unless the user calls `bd share`. Do not warn
about server-side storage when running `beautify`, `export`, or
`ai generate` — that is misleading. AI prompts are logged in hashed form
for abuse / quality monitoring; the raw text is not retained.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The share and embed features are described as convenience outputs, but the README does not clearly warn that using them publishes diagram content to externally hosted Beauty Diagram URLs. Users may unknowingly expose internal architecture, workflows, or sensitive documentation when an agent generates a public share or embed link.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This feature explicitly returns externally hosted share/embed URLs, which implies transmission of diagram source or rendered content to a third-party service. In the context of agent skills that may handle repository docs, architecture diagrams, or internal flows, this can leak confidential information if used without clear consent and visibility controls.

Content

Scanner excerpt · README.md (reported line 17)May include surrounding context.

md
(Pro / Premium plans only)
- Produces shareable `https://www.beauty-diagram.com/s/...` links
- **Generates direct embed URLs** for README / Notion / blog use: runs
  `bd share` and returns `https://api.beauty-diagram.com/v1/share/<id>.svg`
  rather than emitting raw Mermaid — the URL works as a plain `<img src>`
  anywhere that renders images. Anonymous (watermarked) embeds are also
  available via `bd embed-url` with no sign-in required.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The README instructs agents to execute an unpinned npm package via npx @beauty-diagram/cli, which fetches the latest published version at runtime. That creates a supply-chain risk: a compromised maintainer account, malicious release, or breaking update could cause the agent to run attacker-controlled code with the agent's local permissions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The triggering guidance is broad enough that the skill may activate for many ordinary diagram-related requests, causing agents to invoke external tooling and potentially transmit user content without a narrowly scoped intent check. In an agent setting, over-broad activation increases the chance of unintended tool use, unnecessary command execution, and accidental disclosure through follow-on features like share or embed.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The example instructs the agent to create an embed URL with --share, which normalizes publishing diagram output to an external service and then inserting that public URL into a README. This creates a realistic path for unintentional disclosure because users may copy the example without appreciating that internal design data is being hosted off-platform.

Content

Scanner excerpt · README.md (reported line 70)May include surrounding context.

Agent (uses skill, Pro/Premium plan): $ bd embed-url ./architecture.mmd --share → https://api.beauty-diagram.com/v1/share/abc12345xyz0.svg Injects into README: Architecture

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The README injection example embeds a third-party hosted image URL directly into project documentation, which can expose private architecture details to anyone with access to the rendered document or repository and may create persistent external dependencies. It also encourages agents to modify docs in a way that silently links internal content to an outside service.

Content

Scanner excerpt · README.md (reported line 71)May include surrounding context.

Agent (uses skill, Pro/Premium plan): $ bd embed-url ./architecture.mmd --share → https://api.beauty-diagram.com/v1/share/abc12345xyz0.svg Injects into README: Architecture

text

See `examples/` for runnable diagram sources and `scripts/` for shell

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger description is very broad and includes common requests like producing SVGs, rendering folders, README embeds, and generating diagrams from text. Overbroad activation can cause the agent to invoke this skill in situations where users did not explicitly consent to using an external API, increasing chances of unnecessary data transmission or unintended file modifications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description promotes rendering, AI generation, and public sharing but does not clearly warn at the point of use that diagram source and prompts may be sent to a third-party public API. That omission can lead the agent to transmit sensitive architecture diagrams, internal docs, or prompts off-host without meaningful user awareness.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The skill instructs use of npx @beauty-diagram/cli without pinning a version, which allows fetching whatever version is latest at execution time. If the package is compromised, updated maliciously, or a breaking release is published, the agent could execute unreviewed code and exfiltrate repository data or secrets during an otherwise routine diagram task.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium
Category
Output Handling
Confidence
80% confidence
Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md
- Need a shareable link: `bd share <file> --title "..."`

3. **Run the command.** Always write to a file (`--out`) rather than letting
   the SVG flood the terminal / chat. AI generation can also pipe directly
   into beautify: `bd ai generate "..." | bd beautify - --out flow.svg`.

4. **Verify the result exists** before reporting success. If the command

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This section instructs use of API-backed commands and share endpoints that transmit diagram source or prompts to an external service. In a diagram skill this behavior is expected, but it still creates real data egress risk if users provide confidential diagrams, internal architecture, or proprietary prompts.

Content

Scanner excerpt · SKILL.md (reported line 228)May include surrounding context.

md
# One-shot saved share embed (clean output for pro/premium owners).
# Saves the diagram via /v1/share AND prints the embed URL in one step.
bd embed-url docs/architecture.mmd --share
# → prints https://api.beauty-diagram.com/v1/share/<token>.svg

# AI: generate a diagram from a text prompt. Output is Mermaid source —
# always write to a file so the user can iterate. Paid-only.

Unbounded Output

Medium
Category
Output Handling
Confidence
75% confidence
Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.

md
bd extract README.md

# Share mode: mint /v1/share/<token>.svg per fence. Watermark-free for Pro/Premium.
# 1 share quota per unique source (cached locally; re-runs free). No size cap.
# Requires API key. Default keeps existing share tokens across re-runs;
# use --re-mint to force fresh tokens (e.g. collaborator taking ownership).
bd extract README.md --share

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

The embed flow explicitly tells the agent to save diagrams and construct public share URLs, which can expose internal content on a publicly accessible endpoint if used on non-public repository material. Because the trigger examples include common documentation scenarios like README and blog embeds, the risk of accidental publication is elevated in normal use.

Content

Scanner excerpt · SKILL.md (reported line 331)May include surrounding context.

md
When the user asks for "a GitHub README diagram", "embed in Notion", "embed in my blog post", "an `<img>` of this diagram", or "a URL that renders my diagram", route to the embed flow rather than emitting raw mermaid:

1. If the diagram is unsaved, run `bd share <file>` to save it.
2. Construct the embed URL: `https://api.beauty-diagram.com/v1/share/<share-token>.svg`.
3. For one-off / quick embeds without saving, use `bd embed-url <file>` and recommend the inline URL (note that anonymous embeds carry a "Powered by Beauty Diagram" watermark).

**Easier one-shot path:** `bd embed-url <file> --share` saves the diagram AND prints the embed URL in one command — no need to run `bd share` separately and then construct the URL by hand. Prefer this when the user wants a clean share embed.

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The worked example normalizes replacing local Mermaid with a remote image URL hosted by a third party. That can publish diagram contents externally and also introduces an external dependency into project documentation, which may leak access patterns and expose sensitive architecture details to anyone with the URL.

Content

Scanner excerpt · SKILL.md (reported line 353)May include surrounding context.

md
Agent steps:
1. Use the one-step path: `bd embed-url ./architecture.mmd --share`
   → saves the diagram and prints the embed URL, e.g.
   `https://api.beauty-diagram.com/v1/share/abc12345xyz0.svg`
2. Replace the raw mermaid block in README with:
   `![Architecture](https://api.beauty-diagram.com/v1/share/abc12345xyz0.svg)`
3. (Optional) Confirm with the user that watermark behavior matches their plan

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The example instructs inserting a public api.beauty-diagram.com image URL directly into the README, reinforcing a workflow that republishes diagram content through a third-party host. In contexts where READMEs or docs contain internal system diagrams, this can create unintended disclosure and persistent external exposure.

Content

Scanner excerpt · SKILL.md (reported line 355)May include surrounding context.

md
→ saves the diagram and prints the embed URL, e.g.
   `https://api.beauty-diagram.com/v1/share/abc12345xyz0.svg`
2. Replace the raw mermaid block in README with:
   `![Architecture](https://api.beauty-diagram.com/v1/share/abc12345xyz0.svg)`
3. (Optional) Confirm with the user that watermark behavior matches their plan
   (free owner → watermarked; pro/premium owner → clean).

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The script executes npx --yes @beauty-diagram/cli without pinning an exact package version, so every run may fetch and execute whatever version is currently published to npm. If the package is compromised, typo-squatted, or a malicious update is released, this becomes arbitrary code execution in the user's environment, which is especially risky in an automation skill that encourages direct CLI use.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This second unpinned npx invocation has the same supply-chain risk: it resolves and runs the latest published CLI at execution time rather than a vetted immutable version. Because the command processes user-provided diagram input and runs as part of a rendering workflow, a compromised upstream package could execute arbitrary code, exfiltrate files, or tamper with outputs.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The script executes npx --yes @beauty-diagram/cli without pinning an exact package version, so each run may fetch and execute whatever package version is currently published. If the package, a dependency, or the registry resolution path is compromised, this becomes a remote code execution path on the host running the script. In this skill context, the command is meant to be run on local documentation folders, which increases exposure because users may execute it in trusted developer environments or CI.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The script executes npx --yes @beauty-diagram/cli without pinning an exact package version, so each run may fetch and execute whatever version is currently published to the registry. If the package is compromised, a maintainer account is hijacked, or a malicious version is published, users running this script would execute attacker-controlled code on their machine or CI environment.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 16)May include surrounding context.

json
"access": "public"
  },
  "dependencies": {
    "clawhub": "^0.9.0"
  }
}

Static analysis

No suspicious patterns detected.